High Programmer > Alan De Smet > Diceware Word List Comparisons

Diceware Word List Comparisons

Diceware is a highly secure system for generate passwords. I recommend it to anyone for password generation.

(Strictly speaking these are "passphrases," not passwords. But it's what you're going to enter into the little box labeled "password," so close enough.)

But, once you've decided to use Diceware, which list do you use?

So long as the list is entirely filled with unique entries, just about any list is secure. So what matters is how easy is it to remember.

Unfortunately, it's not a matter of just rolling up a password, and if you don't like it, just rolling up another. Doing so means you're filtering out some possible passwords, which reduces your security. For maximum security, you want to commit to using whatever it rolled, exactly as it appears.

To help myself decide, I had a computer program roll up a bunch of passwords for each system so I could get a sense of how memorable they were before doing my real roll.

Warning: Do not use the passwords below. (That is, the 6-8 word long phrases, not the individual words.) They're published, therefore you have to assume password crackers are testing them. Also, do not use my program to generate your own password; it's good enough for examples, but has serious security flaws for real world use. Do like Reinhold says and break out some actual dice to roll.

Per Reinhold's suggestion, I'm working with 6 word phrases as a reasonable default. For the EFF short lists, I'm using 8 words to reach the same level of security.

Reinhold's List

Reinhold's is the original list. In includes memorable non-words, punctuation, and the occasionally offensive word.

Examples:

Beale's List

Beale's list is based on Reinholds, but attempts to remove Americanisms and obscure words.

Examples:

EFF Long

The EFF's list is based on research into words typical English speakers are familiar with. They attempted to remove homonyms, hard-to-spell words, and potentially offensive words. As a result, the average word length is much longer.

Examples:

EFF Short

Using a much shorter word list allowed the EFF to prune their word list down to much shorter words, leaving an average word length close to Reinhold and Beale's. However, the shorter list means you need more words for the same security. To achieve the same security as 6 words from the long list, you need 8 words.

Examples:

EFF Short Variant

While the words in this list are much longer, they all have unique 3 character prefixes and have a minimum dissimilarity. The result is that software could hypothetically autocomplete or correct spelling to help the user.

Examples:

Contact webmaster